Proximity signature for secure communication with implantable medical device

ABSTRACT

Systems, devices and methods employing coded magnetic fields or transfer of encryption key information via proximity telemetry are described. The systems, methods and devices help prevent or reduce unintended or unintentional distance telemetry communication between an external medical device and an implantable medical device.

RELATED APPLICATION

This application claims the benefit of U.S. Provisional Application Ser.No. 60/974,904, filed Sep. 25, 2007.

FIELD OF THE INVENTION

This disclosure relates, inter alia, to implantable medical devices;more particularly to secure communication between implantable medicaldevices and external devices.

BACKGROUND OF THE INVENTION

Medical devices implanted in patients may communicate with devicesexternal to the patients via distance telemetry, such as radio frequencytelemetry. Such distance telemetry communications do not require theexternal device, such as a programmer, to be located in close proximityto the patient, and thus are more convenient than proximity telemetrycommunications. While distance telemetry provides convenience to thecommunication process, security and unintentional access is a concern.For example, it may be possible that multiple implanted devices arewithin telemetric range of an external programming device. If a deviceimplanted in one patient receives therapeutic instructions intended fora device implanted in another patient, the consequences could be dire.By way of another example, it may be possible for unauthorized partiesto eavesdrop on such distance telemetric communications or to sendunauthorized communications to an implanted device. Accordingly, thereis a need to provide more secure communication associated with distancetelemetry with implantable medical device.

BRIEF SUMMARY OF THE INVENTION

The present disclosure presents methods, systems, and devices thatprovide more secure transmission between an external device and animplantable medical device.

In an embodiment, a method associated with establishing securecommunication between an implantable medical device and an externaldevice is described. The method is performed by the implantable medicaldevice and includes receiving a first distance telemetry request forsecure distance communication. The method further includes (i)determining whether a coded proximity telemetry signal is being receivedand (ii) transmitting, via proximity telemetry, information regarding anencryption key if the coded proximity telemetry signal has not beenreceived. The method may further include determining whether a seconddistance telemetry communication containing information encryptedaccording to the encryption key is being received. The method mayfurther include accepting the request for secure distance communicationif the second distance telemetry communication contains informationencrypted according the encryption key.

In an embodiment, a method associated with establishing securecommunication between an implantable medical device and an externaldevice is described. The method is performed by the implantable medicaldevice and includes (i) receiving a first distance telemetry request forsecure distance communication and (ii) transmitting, via proximitytelemetry, information regarding an encryption key. The method furtherincludes determining whether a second distance telemetry communicationcontaining information encrypted according to the encryption key isbeing received. If the second distance telemetry communication containsinformation encrypted according the encryption key, the method furtherincludes accepting the request for secure distance communication.

In an embodiment, a method associated with establishing securecommunication between an implantable medical device and an externaldevice is described. The method is performed by the implantable medicaldevice and includes receiving a first distance telemetry request forsecure distance communication and determining whether a coded proximitytelemetry signal is being received. The coded proximity telemetry signalincludes a coded magnetic field. The method further includes acceptingthe request for secure distance communication if coded proximitytelemetry signal has been received.

In an embodiment, an implantable medical device is described. The deviceincludes a radio frequency transceiver module, an inductive receivermodule, and a processor. The processor is operably coupled to the radiofrequency transceiver module and the inductive receiver module. Theprocessor is configured to compare signals received by the radiofrequency transceiver module and the inductive receiver module todetermine whether the signal received by the inductive receiver moduleis coded in a manner prescribed by the signal received by the radiofrequency transceiver module. The inductive receiver module may be apart of an inductive transceiver module.

In an embodiment, an implantable medical device is described. The deviceincludes a radio frequency transceiver module, an inductive transmittermodule, and a processor operably coupled to the radio frequencytransceiver module and the inductive transmitter module. The processoris to cause the inductive transmitter module to transmit a signalcontaining information regarding an encryption key and is configured todetermine whether a signal received via the radio frequency transceiveris encrypted according to the encryption key. The inductive transmittermodule may be a part of an inductive transceiver module.

In an embodiment, an external medical device capable of communicatingwith an implantable medical device is described. The external deviceincludes a radio frequency transceiver module, an inductive receivermodule, and a processor operably coupled to the radio frequencytransceiver module and the inductive transmitter module. The processoris configured to cause the radio frequency module to transmitinformation encrypted according to encryption key information receivedfrom the inductive receiver module. The inductive receiver module may bea part of an inductive transceiver module.

In an embodiment, an external medical device capable of communicatingwith an implantable medical device is described. The external deviceincludes a radio frequency transceiver module, an inductive transmittermodule, and a processor operably coupled to the radio frequencytransceiver module and the inductive transmitter module. The processoris configured to cause the inductive transmitter module to transmit acoded magnetic field.

By providing devices, systems and methods that provide more securetransmission between external devices and implantable medical devices,unintended or unwarranted programming of the implantable devices may beavoided or minimized. This and other advantages will be readilyunderstood from the following detailed descriptions when read inconjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1-4 are schematic diagrams of scenarios depicting unintended orunwarranted communication between external devices and devices implantedin a patient.

FIGS. 5-6 are schematic block diagrams of representative systems.

FIGS. 7-11 are flow diagrams of representative methods.

The drawings are not necessarily to scale. Like numbers used in thefigures refer to like components, steps and the like. However, it willbe understood that the use of a number to refer to a component in agiven figure is not intended to limit the component in another figurelabeled with the same number. In addition, the use of different numbersto refer to components is not intended to indicate that the differentnumbered components cannot be the same or similar.

DETAILED DESCRIPTION OF THE INVENTION

In the following detailed description, reference is made to theaccompanying drawings that form a part hereof, and in which are shown byway of illustration several specific embodiments of devices, systems andmethods. It is to be understood that other embodiments are contemplatedand may be made without departing from the scope or spirit of thepresent disclosure. The following detailed description, therefore, isnot to be taken in a limiting sense.

All scientific and technical terms used herein have meanings commonlyused in the art unless otherwise specified. The definitions providedherein are to facilitate understanding of certain terms used frequentlyherein and are not meant to limit the scope of the present disclosure.

As used in this specification and the appended claims, the singularforms “a”, “an”, and “the” encompass embodiments having pluralreferents, unless the content clearly dictates otherwise. As used inthis specification and the appended claims, the term “or” is generallyemployed in its sense including “and/or” unless the content clearlydictates otherwise.

It will be understood that, as used herein, information or signals that“are being received” by a device include information or signals that“have been received” by the device, as long as the time frame of thepast receipt is relevant to the secure communication procedure at issue.

The present disclosure describes, inter alia, methods, systems anddevices that provide more secure transmission between external devicesand implantable medical devices. By providing more secure transmission,unintended or unwarranted programming of the implantable devices may beavoided or minimized.

The teachings of the present disclosure may be applied to anyimplantable infusion device capable of telemetric communication via bothdistance and proximity telemetry. For example, the infusion device maybe an implantable signal generator, such as a cardiac defibrillator, acardiac pacemaker, a neurostimulator, a gastric stimulator, or the like;an implantable monitoring device; an implantable infusion device; or thelike.

The teachings of the present disclosure may also be applied to anyexternal device capable of telemetrically communicating with animplantable medical device. For example, external device may be aprogrammer device, a monitoring device, or the like.

Referring to FIG. 1, a schematic diagram of a scenario in which anexternal device 10 capable of communicating via distance telemetry withmore than one implantable device 110, 111 implanted in patients 4, 4′ isshown. As shown in the depicted diagram, without any security orproximity measures, external device 10 can communicate with either ofthe implantable devices 110, 111. However, in most situations, externaldevice 10 is intended to communicate with only one of the implanteddevices 110, 111 at a given time. For example, external device 10 may bea programmer device attempting to send therapy instructions toimplantable device 110 that are tailored to treating patient 4. Ifimplantable device 111 were to receive the therapy instructions intendedfor device 110, serious adverse consequences for patient 4′ couldresult.

Referring to FIG. 2, a schematic diagram of a scenario in which morethan one external device 10, 11 capable of communicating via distancetelemetry with an implantable medical device 110 implanted in a patient4 is shown. In the depicted diagram, both external device 11 andexternal device 10 are within range for telemetric communication withimplanted device 110. However, in the depicted embodiment, only externaldevice 10 is intending to communicate with implantable device 110.Without any security or proximity measures, unintended communicationbetween external device 11 and implanted device 110 may occur.

Referring to FIG. 3, a scenario in which a system capable of proximityand distance telemetry is schematically depicted. In the depictedembodiment, external device 10 is capable of distance communication withimplantable device 110 implanted in patient 4 and implantable device 111implanted in patient 4′. External device 10′ is capable of proximitytelemetry with implantable devices 110, 111 through an inductivemagnetic field. External proximity device 10′ is operably coupled toexternal distance device 10 in the depicted embodiment, and may be, forexample, a programming head. External proximity device 10′ is positionedin proximity to patient 4 at a location near where implantable device110 is implanted. Upon detecting the magnetic field generated byproximity device 10′, implantable device 110 initiates distancetelemetry communication with external distance device 10. Due to theaddition of the proximity measure, such systems provide additionalassurance, relative to systems as described with regard to FIGS. 1-2,that only the intended implantable device 110 will communicate viadistance telemetry with the external device 10.

However, the depicted system is not entirely free from unintendedcommunication without further security measures. As with implantabledevice 110, implantable device 111 will initiate distance telemetrycommunication with external distance device 10 upon detection of amagnetic field. In the depicted embodiment, patient 4′, and thusimplanted device 111, are in the presence of a magnet 255 capable ofproducing a magnetic field detectable by implantable device 111. Themagnetic field may be from, e.g., an MRI instrument. Thus, unintendedcommunication may occur between external distance device 10 andimplanted device 111 when implanted device 111 is in the presence ofmagnet 255 and within range of distance device 10. If distance device 10is intending to send device 110 implanted in patient 4 instructionsregarding therapeutic procedures, unintended communication betweenexternal distance device 10 and implanted device 111 may provide seriousconsequences to patient 4′.

Referring now to FIG. 4, another scenario of unintended or unwarranteddistance telemetry communication is schematically depicted. As discussedwith regard to FIG. 3, proximity external device 10′ is positioned nearpatient 4 at a location in proximity to implanted device 110. Implanteddevice 110 detects a magnetic field emitted from device 10′ and theninitiates communication via distance telemetry with external device 10.In the scenario depicted in FIG. 4, external device 11 is capable ofreceiving distance telemetry communications transmitted from implantabledevice 110 or sending communications to implantable device 110. Withoutappropriate security measures, external device 11 may eavesdrop on thecommunications between implantable device 110 and external device 10.Alternatively or in addition, external device 11 may actively andunintentionally or unwarrantedly communicate with implantable device110.

While it will be understood that many other scenarios may exist whereunintentional or unwarranted distance telemetric communication with animplantable medical device may occur and that the devices, systems andmethods described herein may address one or more of such scenarios, thediscussion that follows will refer to the scenarios presented in, anddescribed above with regard to, FIGS. 1-4, particularly FIGS. 3-4, forthe sake of convenience and clarity.

Referring now to FIGS. 5 and 6, schematic block diagrams of systemscapable of proximity and distance telemetry are shown. The systemincludes an implantable medical device 110 having a hermetically sealedhousing containing various operative components and is configured to beimplanted in a patient. Device components provided to operate theimplantable medical device 110 will vary depending upon the type ofdevice and may include, for example, a pulse generator, capacitors,leads, sensors, accelerometers, pumping mechanisms, reservoirs, andvarious other components. In addition to a distance telemetry module 130and a proximity telemetry module 120, a processor 150, power source 140,memory 160, clock 170, and therapy output module 190 are typicallyprovided.

Processor 150 may be synchronous and typically operates on low power,such as Motorola 68HC11 synthesized core operating with a compatibleinstruction set. Clock 170 may date/time stamp events and may be usedfor therapy control. Memory 160 includes memory sufficient for operationof device 110, such as volatile Random Access Memory (RAM) for examplestatic RAM, nonvolatile Read Only Memory (ROM), Electrically ErasableProgrammable Read Only Memory (EEPROM) for example Flash EEPROM, andregister arrays configured on Application Specific Integrated Circuits(ASICs). Direct Memory Access (DMA) may be available to selected modulessuch as telemetry modules 120, 130 so that the selected modules canrequest control of a data bus and write data directly to memory 160bypassing processor 150.

Therapy output module 190 refers to components for carrying out thedelivery or generation of therapeutic output to be delivered to apatient from implantable device 110. One of skill in the art willappreciate that the components may vary on a device-by-device basis anda therapy-by-therapy basis. For example, therapy module 190 may containan oscillator if implantable medical device 110 is an electrical signalgenerator and may contain a pumping mechanism if device 110 is aninfusion device.

Other components of implantable medical device 110 can include, e.g., asystem reset module, diagnostics module, sensor module or rechargemodule (not shown). In various embodiments, all components except thepower source 140, which may be a battery, can be configured on one ormore ASICs or may be one or more discrete components, or a combinationof both. In various embodiments, all components, except the clock andpower source may be connected to a bi-directional data bus that isnon-multiplexed with separate address and data lines.

Distance telemetry module 130 may include a transmitter, receiver,antenna, processor or other components necessary or desirable forcarrying out distance telemetric communication. Distance telemetrytypically refers to communications via radio frequency (RF) signals andincludes telemetry M and telemetry C platforms. In general, distancetelemetry communication may take place at distances of one meter ormore, more typically over the range of about 3-20 meters. Of course,components of distance telemetry systems may communicate at distances ofless than one meter. Distance telemetry modules are generally known inthe art and various aspects are described in, for example, U.S. Pat. No.6,240,317 issued to Villaseca et al. (May 29, 2001), and U.S. Pat. No.6,482,154 issued to Haubrich et al. (Nov. 19, 2002).

Proximity telemetry module 120 may include a transmitter, receiver,antenna, processor or other components necessary or desirable forcarrying out proximity telemetric communication. An example of proximitytelemetry is inductive coupling, in which case proximity telemetrymodule 120 includes an inductive coil. Proximity telemetry modules aregenerally known in the art and are further detailed in, for example,U.S. Pat. No. 5,752,977 issued to Grevious, et al. (May 19, 1998).

It will be appreciated that a transceiver may be a discrete componentthat performs the functions of both the receiver and transmitter, andthat the use of the latter terms will include the former.

The system may include one or more external devices 10, 10′, which maybe configured in a variety of ways. In the embodiment depicted in FIG.5, external device 10 includes both a distance telemetry module 30configured to communicate with implantable device 110 via telemetrymodule 130 and a proximity telemetry module 20 configured to communicatewith implantable device 110 via telemetry module 120. Distance telemetrymodule 30 and proximity telemetry module 20 may include components asdescribed above with regard to distance telemetry 130 and proximitytelemetry 120 modules of implantable device 110. External device 10 mayalso include a processor 50, power source 40, memory 60, clock 70, orany other component necessary or desirable for operation of externaldevice, including a display, a data input module, or the like.

In the embodiment depicted in FIG. 6, the system includes an externaldevice 10′ containing proximity telemetry module 20. External device 10′is separate from external device 10, which includes distance telemetrymodule 30. In various embodiments, external device 10′ is a component ofexternal device 10, but devices 10, 10′ are contained in differenthousings. For example, external device 10′ may be a programming head andtelemetry module 20 may be operably coupled to processor 50 wirelesslyor via wired mechanism. While not shown, it will be understood thatexternal device 10′ may include other components necessary or desirablefor operation of external device, regardless of whether external device10′ is operably coupled to external device 10.

It will be understood that the components, devices and systems describedwith regard to FIGS. 1-6 are but examples of components, devices andsystems that may be employed to engage in more secure distancecommunication with an implantable medical device. However, for the sakeof convenience, the discussion that follows with regard to FIGS. 7-11will refer to devices and components as described with regard to FIGS.1-6.

Referring to FIG. 7, a flow diagram of a method for establishing asecure distance telemetry communication is shown. The method includesreceiving a distance telemetry signal from an external device 10 (500).The signal may be received via distance telemetry module 130 ofimplantable device 110. The signal may include an active request forsecured communication from an external device 10 or may contain arequest for which the implantable device 110 is programmed to recognizeas requiring secured communication, such as, for example, a request forpatient specific information or information regarding therapyparameters, a request to program the implantable device 110,instructions to modify therapy parameters of the implantable device 110,or the like. A determination is then made as to whether a codedproximity telemetry signal is being received (510). For example, uponreceiving the distance telemetry signal via distance telemetry module130, processor 150 may monitor proximity telemetry module 120 todetermine whether a coded signal is being received. The coded signal, inthe case of inductive coupling proximity telemetry, is a distinctivemagnetic field signature. The parameters that can be varied include theclock rate of the field and the duty cycle of the field. The coded fieldmay comprise a distinctive low speed variation, such as an on-off key ata predetermined rate. If the duty cycle is varied, it may be desirablefor it to be varied by other than 50% to make it more difficult tounintentionally or unwarrantedly duplicate the coded signature.

The distinctive feature of the coded field may be preprogrammed into theimplantable device 110. In such circumstances, processor 150 may comparefeatures of a signal received by proximity telemetry module 120 to oneor more distinctive signatures stored in memory 160 to determine whetherthe proximity telemetry signal is appropriately coded. Alternatively, orin addition, information regarding the coding of the proximity signalmay be provided in the distance telemetry request for securecommunication. Processor 150 may determine whether information receivedvia distance telemetry module 130 regarding the coding of proximitytelemetry signal matches the coding signature actually being receivedvia proximity telemetry module to determine whether an appropriatelycoded proximity telemetry signal is being received (510).

If a properly coded signal is being received, the implantable device 110may then accept the request for secure communication and establishdistance telemetry communication with the external device 10 (520). Ifprocessor 150 determines that the proximity telemetry signal is notproperly coded, secured distance communication may be declined (530). Bydeclining secured distance communication, the implantable device maysend to external device 10, via distance telemetry module 130, formalnotice of declining, may fail to respond to the external device 10, orthe like.

As depicted in FIG. 8, implantable device 110 may determine whether apreset amount of time has expired (540) before declining the request forsecure distance telemetry communication (530). For example, clock 170may time stamp the receipt of the initial request for distance telemetrycommunication (500) and processor 150 may determine whether sufficienttime has passed without receiving an appropriately coded proximitytelemetry signal before declining the request for distance telemetrysecure communication.

By introducing the security measure of a coded proximity signal asdescribed with regard to FIGS. 7 and 8, the scenario of unintendedcommunication with or programming of unintended implantable device 111as discussed with regard to FIG. 3 may be avoided or minimized.

Of course, it will be understood that upon receipt of a distancetelemetry request for secure communication, the implantable device 110may produce via proximity telemetry module 120 the coded field that isreceived by proximity telemetry module 20 of external device 10 (orexternal proximity device 10′ operably coupled to external distancedevice 10), as opposed to the coded signal being received by theimplantable device 110. Following receipt of the coded field, externaldevice 10 may initiate secure transmission. Initiation of securetransmission may include the exchange of an encryption key either viadistance or proximity telemetry, which will be discussed in more detailbelow.

Referring now to FIG. 9, a flow diagram of an illustrative method forestablishing a secure distance telemetry communication is shown. Uponreceipt of a distance telemetry request for secure communication (500),e.g. as discussed above with regard to FIG. 7, implantable device 110may transmit information regarding an encryption key to external device10, (or external proximity device 10′ operably coupled to externaldistance device 10), via proximity telemetry module 120 (550). Processor50 of external device 10, upon receiving the information regarding theencryption key from proximity telemetry module 20 may cause distancetelemetry module 30 to encrypt transmitted information. Implantabledevice 110 can then determine whether properly encrypted information isbeing received (560), via distance telemetry module 130. If the signalreceived via distance telemetry module 130 is properly encrypted, theimplantable device 110 may accept the request for secure communicationand establish distance telemetry communication with the external device10 (520). If the implantable device 110 does not receive a properlyencrypted distance telemetry signal within a predetermined amount oftime (540), the request for secure communication may be declined (530),e.g. as described with regard to FIG. 7.

By introducing the security measure of transfer of an encryption key viaproximity telemetry, as described with regard to FIG. 9, the scenario ofunintended communication with or programming of unintended implantabledevice 111 as discussed with regard to FIG. 3 may be avoided orminimized. In addition the scenario of unintended or unwarrantedcommunication as discussed with regard to FIG. 4 may also be eliminatedor minimized. Of course, it will be understood that the encryption keymay be transmitted by the external device via proximity telemetry module20 and received by implantable device 110 to avoid unwarranted orunintended communication.

An additional representative method that will reduce the likelihood ofunintended communication as described with regard to the scenariodepicted in FIG. 3 is shown in the flow diagram of FIG. 10. As describedwith regard to FIG. 7, a distance telemetry request for securecommunication may be received (500) and implantable device 110 may thendetermine whether a coded proximity telemetry signal is being received(510). If so, implantable device 110 may transmit an encryption key viadistance telemetry (555) and determine whether a distance telemetrysignal with information encrypted according to the key is being received(560), as described above with regard to FIG. 9. If both the codedproximity telemetry signal and the key encrypted distance telemetrysignal are being received, the implantable medical device 110 may acceptthe request for secure distance telemetry (520). Otherwise, theimplantable device 530 may decline the request for secured distancetelemetry (530).

For additional security, both the transfer of an encryption key viaproximity telemetry (e.g., as discussed with regard to FIG. 9) and thetransmission of a coded signal via proximity telemetry (e.g., asdiscussed with regard to FIGS. 7 and 8) may be employed. For example andreferring to FIG. 11, upon receipt of a distance telemetry request forsecure communication (500), implantable device 110 may determine whethera properly coded proximity signal is being received (510). If a properlycoded proximity signal is being received, the implantable device 110 maytransmit an encryption key via proximity telemetry (550). The externaldevice 10 may encrypt information sent via distance telemetry with theappropriate key, and the implantable device 110 may determine whether itis receiving properly encrypted information via distance telemetry(560). If so, secure distance communication may be established betweenthe implantable device 110 and the external device 10. If either theproperly coded proximity signal is not received or the properlyencrypted distance telemetry signal is not received, the implantabledevice 110 may decline the request for secure distance communication(530).

One of skill in the art will understand that components or stepsdescribed herein regarding a given embodiment or set of embodiments mayreadily be omitted, substituted, or added from, with, or to componentsor steps of other embodiments or sets of embodiments, as appropriate ordesirable. It will be further understood that a computer readable mediumcontaining instructions that when implemented cause an implantablemedical device or external device to perform the methods describedherein are contemplated.

Thus, embodiments of PROXIMITY SIGNATURE FOR SECURE COMMUNICATION WITHIMPLANTABLE MEDICAL DEVICE are disclosed. One skilled in the art willappreciate that various aspects of the present disclosure can bepracticed with embodiments other than those disclosed. The disclosedembodiments are presented for purposes of illustration and notlimitation, and the present invention is limited only by the claims thatfollow.

What is claimed is:
 1. A method of establishing secure communicationbetween an implantable medical device and an external device, the methodbeing performed by the implantable medical device and comprising:receiving a first distance telemetry request for secure distancecommunication; determining whether a coded proximity telemetry signal isbeing received; transmitting, via distance telemetry, informationregarding an encryption key; determining whether a second distancetelemetry communication containing information encrypted according tothe encryption key is being received; and accepting the request forsecure distance communication if the second distance telemetrycommunication contains information encrypted according to the encryptionkey.
 2. The method of claim 1, further comprising: declining the requestfor secure distance communication if the second distance telemetrycommunication does not contain information encrypted according to theencryption key.
 3. The method of claim 1, wherein transmitting, viadistance telemetry, information regarding an encryption key comprisestransmitting the encryption key.
 4. The method of claim 1, whereindetermining whether a coded proximity telemetry signal is being receivedcomprises determining whether the telemetry signal matches a codingsignature.
 5. The method of claim 1, wherein determining whether a codedproximity telemetry signal is being received comprises determining atleast one of a clock rate, a duty cycle, and an on-off key rate of thesignal.
 6. The method of claim 1, wherein determining whether a codedproximity telemetry signal is being received comprises comparing theproximity telemetry signal to one or more stored signatures.
 7. Themethod of claim 1, wherein determining whether a coded proximitytelemetry signal is being received comprises determining whetherinformation received via distance telemetry matches the coding of thecoded proximity telemetry signal.
 8. The method of claim 1, wherein thecoded proximity telemetry signal comprises a coded magnetic field. 9.The method of claim 1, wherein accepting the request for secure distancecommunication further comprises accepting the request for securedistance communication if the coded proximity telemetry signal has beenreceived.
 10. The method of claim 1, further comprising receivinginformation regarding the code of the coded proximity telemetry signalvia the request for secure distance communication.
 11. The method ofclaim 1, further comprising declining the first distance telemetryrequest for secure distance communication if a predetermined amount oftime expires between receiving the first distance telemetry request anddetermining that the coded proximity telemetry signal has been received.12. An implantable medical device, comprising: a receiver module; atransceiver module configured to receive a first distance telemetryrequest for secure distance communication and to transmit, via distancetelemetry, information regarding an encryption key; and a processorconfigured to: determine whether a coded proximity telemetry signal isbeing received by the receiver module, determine whether a seconddistance telemetry communication containing information encryptedaccording to the encryption key is being received, and to accept therequest for secure distance communication if the second distancetelemetry communication contains information encrypted according to theencryption key.
 13. The implantable medical device of claim 12, whereinthe transceiver module is a radio frequency transceiver module.
 14. Theimplantable medical device of claim 12, wherein the receiver module isan inductive receiver module.
 15. The implantable medical device ofclaim 12, wherein the processor is configured to compare signalsreceived by the transceiver module to signals received by the receivermodule to determine whether the coded proximity telemetry signal isbeing received.
 16. The implantable medical device of claim 12, whereinthe processor is configured to compare signals received by the receivermodule to stored signatures to determine whether the coded proximitytelemetry signal is being received.
 17. The implantable medical deviceof claim 12, wherein the transceiver module is configured to transmitthe encryption key.